dcrat | 00c11ab6fa421c4e69915b1d5db441df33cfcc7c61128bb81029816fd0aa222e[.]exe | Triage

Sharing

General

Target

00c11ab6fa421c4e69915b1d5db441df33cfcc7c61128bb81029816fd0aa222e.exe
Size

829KB
MD5

28b77e68b269756ba427c8d30deef9de
SHA1

815371ee33e46a6b1a1257b6e01bbaf46ce8d0f5
SHA256

00c11ab6fa421c4e69915b1d5db441df33cfcc7c61128bb81029816fd0aa222e
SHA512

23488adba74b5c22bca70c2b307020b00696eafc37041bd4a578227d2d4ac6c5ac5f1b107159ea9a15ff08fb865409e06164649a1a2b584fb5bc0b8186b73554
SSDEEP

24576:REKNonGb2iV7XQyzP9miug5/JXqY/0u0DT:REK+nC7dmzg5Mu0

Score

10^/10

rat dcrat

Malware Config

Signatures

DCRat payload 1 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

resource	yara_rule
sample	dcrat

Dcrat family
dcrat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00c11ab6fa421c4e69915b1d5db441df33cfcc7c61128bb81029816fd0aa222e.exe

Files

00c11ab6fa421c4e69915b1d5db441df33cfcc7c61128bb81029816fd0aa222e.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 814KB - Virtual size: 814KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ